Subject: Re: [keyassure] Trust models (was: Securing Last Mile)

From: "Jeffrey A. Williams" <[email-masked]>
Date: Mon, 30 Aug 2010 17:23:49 -0500 (GMT-05:00)

Paul H., and all,

  Yes, nicely stated.

-----Original Message-----
>From: Paul Hoffman <[email-masked]>
>Sent: Aug 30, 2010 5:14 PM
>To: [email-masked]
>Subject: [keyassure] Trust models (was: Securing Last Mile)
>
>At 11:58 AM -0700 8/30/10, Nicholas Weaver wrote:
>>On Aug 30, 2010, at 1:57 AM, OndÞej Sur wrote:
>>> Bigger:
>>> 3) Secure Last Mile: I think it was already stated here (or on other place) that simply trusting AD bit is not sufficient, and there is a strong need for securing last mile.  Could it be a validating resolver on localhost (but it's not secure on multi-user machine).  Could it be IPSec (but this is probably valid only in strictly controlled environment).  Could be SIG(0) to your resolver?
>>
>>Actually, the resolver on localhost is secure on a multi-user machine, in the sense that any adversary who could corrupt that resolver could corrupt other parts of the victim.
>>
>>IPSec or others to a "trusted" secondary resolver is, IMO, silly:  DNSSEC is all about not needing to trust the infrastructure, so why change the DNS client model to one that establishes a 'secure' connection to a 'trusted' resolver instead of just having the client validate the information directly and, if it can't validate the information, fetches it for itself if you don't trust the external resolver?
>
>This exposes something that people in the security community constantly grapple with / trip over: who is the trust anchor? In the "localhost" scenario above, it is the DNSSEC root or whichever lower DNSSEC trust anchors you have manually installed. In the "IPsec or others" scenario, it is a trusted third party who is doing resolution for you, such as "your ISP" or "your corporation".
>
>Those are radically different models that are desired by different types of people with different needs. You can't say one is more important than the other because you are making a value judgement for people with whom you disagree.
>
>The "localhost" solution is defined today. The "IPsec or others" is too, but in a zillion different ways. If there is interest in making the latter more focused, that's great, but such work is for the DNSEXT WG, not here.
>
>--Paul Hoffman, Director
>--VPN Consortium
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827